github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-07-30 11:11:26 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

TEE fixes for v6.17

Browse Source 
- Fixing a memory leak in the error path for tee_dyn_shm_alloc_helper()
 - Fixing a NULL pointer dereference in tee_shm_put()
 -----BEGIN PGP SIGNATURE-----
 
 iQJOBAABCgA4FiEE0qerISgy2SKkqO79Wr/6JGat8H4FAmikTdgaHGplbnMud2lr
 bGFuZGVyQGxpbmFyby5vcmcACgkQWr/6JGat8H57khAA4GAWaj/g2Y7rI8JVoKfG
 mtCUOmB4cDechzI/QQwkSLdCgBRo4q3pwpgnSCgYSoPRna8TsFTUdj02QzIWbT3z
 f15hCSOaX5WsgNp9mZc3FiAMwOXlpAXKUREa72MrC8WvTLEmVqpI0JyybDlahjrk
 w2H1X/V94PH+YQnyoSntLOApA+r54RJwtmuOs6PacCapftHROpon4ezyRSbE/FCM
 MkuTQ8CliazFMDr1e7W168iT4RgQo8ST+Umr9DUwC0xfIbIAcMyVScYKFzmKYWke
 iS7p/mB0gsikTydmPgy6Smw3ynCN7bsiZlk/gZkv0zczkG6u3szWwXmhzsuCy/qk
 IyZPANAnlr3lh6bbPHwDBrJsnxshDvMB9ls4NG2vV7iKIv47bDqJEJ9Gp7iDYKGg
 IngHuc0qajmZlaaC5tV6eDy7fxOoUidbGtdRhCmniJl9Rz/IYvxvXmQtYo4t+IKw
 1UE3RAcjHJNqzOhJtjbfK/tDM143dNgSwttbXMuesr3Se647s8VWdrvHwmznpfG+
 yq5CP4oWv5u/sDg38wvPHscyBRkjKVmhnFWsIIFjMBwjwmXCIrgbSAPzCkB7jufx
 D3iy1r4xS4m1hTRBlY96tR0FXvPki4WR3kjogJeonbkpjBDHHTTcQXYUn4teLYmI
 9zQkFWw2GdGTkKP2LCTq9EA=
 =AfU2
 -----END PGP SIGNATURE-----
gpgsig -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEo6/YBQwIrVS28WGKmmx57+YAGNkFAmi1Wp4ACgkQmmx57+YA
 GNmXKg/9H+UYN6h8UBmm1guxYFN695gnwXtmvBN10Y2U4OkwjMX6HgfNKrwXRnw5
 nok/jLGihcRfqm+fMTJUS9PrOj+6cVKtww63DHpd+RX1LjNbbvKr8ErhM7JifNGd
 5hS5MQ48xlmAdloJCTxbV0OjmABD9Ka8CUvdfPuJRaGTqj1kauBHbUWLijmDloLl
 wf1lpkof0zn1Cxgn+A1VQwz+KlIXtCPcFpefZDmi81daOpj53kterI7MdJiTP0rn
 aELO99+QNeiGqFqN3LXSml2qQAzdsrJ/WdIG6IIZlABxo7Vk91nCwLhi3cPwGKQn
 ib0wPdyI4gNK02FgCRuRda0VNlgoBiGTPUYoR/JOHgHGCBatv1H60b1hoPpNSMvx
 aZo/FkqgPWBz3A/p4ASbGaIhIMrR/NFLgkKjQlyp3M2UwlANCZQ59q45kD4hWsz5
 q80IRvGj+mdV2LyZrmY2i9FJyzXMkPM+1allItnCR3ZhkXQuf3r90ltUUh/nMneC
 KIqBDPe+nyY5i9lHh/w/u64iwEhSqtgvIYgwm5BtoeCssNVXoUNbHJ6JZu+BYr0H
 RcTgAHYKIL+aQzRjwfI3GL3M60DvfsrXyGxMdH1XDCa7AAbkRRrJHIoPzmh++h+g
 Tt7+2KIIBC/OJy/a+/A6J1YgTO/LzC94JOivu+9zN0KzCzpmgC4=
 =Lyrr
 -----END PGP SIGNATURE-----

Merge tag 'tee-fixes-for-v6.17' of https://git.kernel.org/pub/scm/linux/kernel/git/jenswi/linux-tee into arm/fixes

TEE fixes for v6.17

- Fixing a memory leak in the error path for tee_dyn_shm_alloc_helper()
- Fixing a NULL pointer dereference in tee_shm_put()

* tag 'tee-fixes-for-v6.17' of https://git.kernel.org/pub/scm/linux/kernel/git/jenswi/linux-tee:
  tee: fix memory leak in tee_dyn_shm_alloc_helper
  tee: fix NULL pointer dereference in tee_shm_put

Link: https://lore.kernel.org/r/20250819122641.GA3486750@rayden
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
This commit is contained in:
Arnd Bergmann 2025-09-01 10:34:33 +02:00
commit 84bc3c0b58
1 changed files with 10 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
drivers/tee/tee_shm.c
View File

@ -230,7 +230,7 @@ int tee_dyn_shm_alloc_helper(struct tee_shm *shm, size_t size, size_t align,
pages = kcalloc(nr_pages, sizeof(*pages), GFP_KERNEL);
if (!pages) {
rc = -ENOMEM;
goto err;
goto err_pages;
}
for (i = 0; i < nr_pages; i++)
@ -243,11 +243,13 @@ int tee_dyn_shm_alloc_helper(struct tee_shm *shm, size_t size, size_t align,
rc = shm_register(shm->ctx, shm, pages, nr_pages,
(unsigned long)shm->kaddr);
if (rc)
goto err;
goto err_kfree;
}
return 0;
err:
err_kfree:
kfree(pages);
err_pages:
free_pages_exact(shm->kaddr, shm->size);
shm->kaddr = NULL;
return rc;
@ -560,9 +562,13 @@ EXPORT_SYMBOL_GPL(tee_shm_get_from_id);
*/
void tee_shm_put(struct tee_shm *shm)
{
struct tee_device *teedev = shm->ctx->teedev;
struct tee_device *teedev;
bool do_release = false;
if (!shm || !shm->ctx || !shm->ctx->teedev)
return;
teedev = shm->ctx->teedev;
mutex_lock(&teedev->mutex);
if (refcount_dec_and_test(&shm->refcount)) {
/*